CVE-2024-24567
published 2024-01-30CVE-2024-24567: Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. Vyper compiler allows passing a value in builtin raw_call even if the call is a…
PriorityP428medium5.3CVSS 3.1
AVNACLPRNUINSUCNILAN
EPSS
0.48%
38.4th percentile
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. Vyper compiler allows passing a value in builtin raw_call even if the call is a delegatecall or a staticcall. But in the context of delegatecall and staticcall the handling of value is not possible due to the semantics of the respective opcodes, and vyper will silently ignore the value= argument. If the semantics of the EVM are unknown to the developer, he could suspect that by specifying the `value` kwarg, exactly the given amount will be sent along to the target. This vulnerability affects 0.3.10 and earlier versions.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| vyperlang | vyper | <= 0.3.10 | — |
| vyperlang | vyper | >= 0 < 0.4.0 | 0.4.0 |
| vyperlang | vyper | >= 0 < 0.4.0b1 | 0.4.0b1 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Vyper's raw_call `value=` kwargs not disabled for static and delegate calls
osv·2024-01-30
CVE-2024-24567 [MEDIUM] Vyper's raw_call `value=` kwargs not disabled for static and delegate calls
Vyper's raw_call `value=` kwargs not disabled for static and delegate calls
### Summary
Vyper compiler allows passing a value in builtin `raw_call` even if the call is a `delegatecall` or a `staticcall`. But in the context of `delegatecall` and `staticcall` the handling of value is not possible due to the semantics of the respective opcodes, and vyper will silently ignore the `value=` argument.
A contract search was performed and no vulnerable contracts were found in production.
### Details
The IR for `raw_call` is built in the `RawCall` class:
https://github.com/vyperlang/vyper/blob/9136169468f317a53b4e7448389aa315f90b95ba/vyper/builtins/functions.py#L1100
However, the compiler doesn't validate that if either `delegatecall` or `staticall` are provided as kwargs, that `value` wasn't se
GHSA
Vyper's raw_call `value=` kwargs not disabled for static and delegate calls
ghsa·2024-01-30
CVE-2024-24567 [MEDIUM] CWE-754 Vyper's raw_call `value=` kwargs not disabled for static and delegate calls
Vyper's raw_call `value=` kwargs not disabled for static and delegate calls
### Summary
Vyper compiler allows passing a value in builtin `raw_call` even if the call is a `delegatecall` or a `staticcall`. But in the context of `delegatecall` and `staticcall` the handling of value is not possible due to the semantics of the respective opcodes, and vyper will silently ignore the `value=` argument.
A contract search was performed and no vulnerable contracts were found in production.
### Details
The IR for `raw_call` is built in the `RawCall` class:
https://github.com/vyperlang/vyper/blob/9136169468f317a53b4e7448389aa315f90b95ba/vyper/builtins/functions.py#L1100
However, the compiler doesn't validate that if either `delegatecall` or `staticall` are provided as kwargs, that `value` wasn't se
OSV
CVE-2024-24567: Vyper is a pythonic Smart Contract Language for the ethereum virtual machine
osv·2024-01-30
CVE-2024-24567 CVE-2024-24567: Vyper is a pythonic Smart Contract Language for the ethereum virtual machine
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. Vyper compiler allows passing a value in builtin raw_call even if the call is a delegatecall or a staticcall. But in the context of delegatecall and staticcall the handling of value is not possible due to the semantics of the respective opcodes, and vyper will silently ignore the value= argument. If the semantics of the EVM are unknown to the developer, he could suspect that by specifying the `value` kwarg, exactly the given amount will be sent along to the target. This vulnerability affects 0.3.10 and earlier versions.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/vyperlang/vyper/blob/9136169468f317a53b4e7448389aa315f90b95ba/vyper/builtins/functions.py#L1100https://github.com/vyperlang/vyper/security/advisories/GHSA-x2c2-q32w-4w6mhttps://github.com/vyperlang/vyper/blob/9136169468f317a53b4e7448389aa315f90b95ba/vyper/builtins/functions.py#L1100https://github.com/vyperlang/vyper/security/advisories/GHSA-x2c2-q32w-4w6m
2024-01-30
Published